PaperCut Print Software Under Attack: Exploitation Began Before a Patch Was Available

On Thursday, 27 August 2026, PaperCut published an advisory saying a vulnerability in its print management software was being exploited in the wild, leading to system compromise. The advisory was released without a patch. It did include indicators of compromise in the form of log snippets, along with temporary mitigations, so customers could start taking action. According to watchTowr Labs, much of the detail was still unclear at that point. Its global honeypot network captured the in-the-wild exploitation.

PaperCut helps organizations monitor, control and secure printing across their networks, with features such as print quotas, secure release printing and cost tracking. It is widely used by schools, universities, healthcare providers, government agencies, law firms and businesses of all sizes. That mix makes it an attractive target for advanced threat groups and ransomware gangs. The source notes that PaperCut has been targeted before, including through CVE-2023-27351 and CVE-2023-27350.

watchTowr's research covers a timeline from 27 August to 1 September and refers to multiple vulnerabilities and patch bypasses, including CVE-2026-82077, CVE-2026-82078 and CVE-2026-81578. It also mentions a second patch, version 26.0.4-PO build 76508. The excerpt provided is only the opening of the article, so the technical findings and full timeline are not covered here.